Hello, I found a bug titled :BUG: possible deadlock in nilfs_bmap_lookup_at_level ; with modified syzkaller in the Linux6.14-rc5. If you fix this issue, please add the following tag to the commit: Reported-by: Jianzhou Zhao <xnxc22xnxc22@xxxxxx>, xingwei lee <xrivendell7@xxxxxxxxx> I use the same kernel as syzbot instance upstream: 7eb172143d5508b4da468ed59ee857c6e5e01da6 kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=da4b04ae798b7ef6 compiler: gcc version 11.4.0 ------------[ cut here ]----------------------------------------- TITLE: possible deadlock in nilfs_bmap_lookup_at_level ================================================================== WARNING: possible circular locking dependency detected 6.14.0-rc5-dirty #17 Not tainted ------------------------------------------------------ segctord/13049 is trying to acquire lock: ffff88805a1400c0 (&nilfs_bmap_dat_lock_key){++++}-{4:4}, at: nilfs_bmap_lookup_at_level+0x7f/0x460 fs/nilfs2/bmap.c:65 but task is already holding lock: ffff88805a142d60 (&bmap->b_sem){++++}-{4:4}, at: nilfs_bmap_propagate+0x25/0x170 fs/nilfs2/bmap.c:328 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #4 (&bmap->b_sem){++++}-{4:4}: down_write+0x92/0x200 kernel/locking/rwsem.c:1577 nilfs_bmap_clear+0x1c/0xa0 fs/nilfs2/bmap.c:305 nilfs_clear_inode+0x28a/0x330 fs/nilfs2/inode.c:836 nilfs_evict_inode+0x3c1/0x530 fs/nilfs2/inode.c:856 evict+0x3ef/0x860 fs/inode.c:796 dispose_list+0x124/0x1f0 fs/inode.c:845 prune_icache_sb+0xf0/0x150 fs/inode.c:1033 super_cache_scan+0x2d2/0x490 fs/super.c:223 do_shrink_slab+0x464/0x11d0 mm/shrinker.c:437 shrink_slab_memcg mm/shrinker.c:550 [inline] shrink_slab+0x92e/0x12c0 mm/shrinker.c:628 shrink_one+0x4a8/0x7d0 mm/vmscan.c:4868 shrink_many mm/vmscan.c:4929 [inline] lru_gen_shrink_node mm/vmscan.c:5007 [inline] shrink_node+0x2355/0x3c10 mm/vmscan.c:5978 kswapd_shrink_node mm/vmscan.c:6807 [inline] balance_pgdat+0xa85/0x1740 mm/vmscan.c:6999 kswapd+0x4c0/0xbe0 mm/vmscan.c:7264 kthread+0x427/0x880 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #3 (fs_reclaim){+.+.}-{0:0}: __fs_reclaim_acquire mm/page_alloc.c:3853 [inline] fs_reclaim_acquire+0x102/0x150 mm/page_alloc.c:3867 might_alloc include/linux/sched/mm.h:318 [inline] slab_pre_alloc_hook mm/slub.c:4066 [inline] slab_alloc_node mm/slub.c:4144 [inline] kmem_cache_alloc_node_noprof+0x52/0x4b0 mm/slub.c:4216 __alloc_skb+0x2ad/0x370 net/core/skbuff.c:596 alloc_skb include/linux/skbuff.h:1331 [inline] alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:289 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline] kobject_uevent_env+0xc87/0x16c0 lib/kobject_uevent.c:608 kobject_synth_uevent+0x716/0x870 lib/kobject_uevent.c:207 bus_uevent_store+0x3f/0xa0 drivers/base/bus.c:832 bus_attr_store+0x71/0xb0 drivers/base/bus.c:172 sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:139 kernfs_fop_write_iter+0x344/0x510 fs/kernfs/file.c:334 new_sync_write fs/read_write.c:586 [inline] vfs_write fs/read_write.c:679 [inline] vfs_write+0xb9f/0x1100 fs/read_write.c:659 ksys_write+0x122/0x240 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #2 (uevent_sock_mutex){+.+.}-{4:4}: __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x16f/0x2020 kernel/locking/mutex.c:730 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:410 [inline] kobject_uevent_env+0xb0f/0x16c0 lib/kobject_uevent.c:608 loop_set_size drivers/block/loop.c:235 [inline] loop_set_size.isra.0+0x9b/0xc0 drivers/block/loop.c:232 loop_set_status+0x4d9/0xbe0 drivers/block/loop.c:1292 loop_set_status_old+0x148/0x1c0 drivers/block/loop.c:1391 lo_ioctl+0xd83/0x1c30 drivers/block/loop.c:1561 blkdev_ioctl+0x27b/0x6d0 block/ioctl.c:693 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x19b/0x210 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #1 (&q->q_usage_counter(io)#21){++++}-{0:0}: bio_queue_enter block/blk.h:78 [inline] blk_mq_submit_bio+0x1ca5/0x2570 block/blk-mq.c:3091 __submit_bio+0x63b/0x10b0 block/blk-core.c:628 __submit_bio_noacct_mq block/blk-core.c:715 [inline] submit_bio_noacct_nocheck block/blk-core.c:744 [inline] submit_bio_noacct_nocheck+0x678/0xd30 block/blk-core.c:721 submit_bio_noacct+0x6c9/0x1ea0 block/blk-core.c:867 nilfs_btnode_submit_block+0x523/0x6f0 fs/nilfs2/btnode.c:139 __nilfs_btree_get_block+0x10a/0x6a0 fs/nilfs2/btree.c:481 nilfs_btree_do_lookup+0x3f5/0x8f0 fs/nilfs2/btree.c:579 nilfs_btree_lookup+0x45/0x70 fs/nilfs2/btree.c:695 nilfs_bmap_lookup_at_level+0xd4/0x460 fs/nilfs2/bmap.c:66 nilfs_bmap_lookup fs/nilfs2/bmap.h:182 [inline] nilfs_mdt_submit_block+0x1a1/0x890 fs/nilfs2/mdt.c:144 nilfs_mdt_read_block+0x93/0x3c0 fs/nilfs2/mdt.c:178 nilfs_mdt_get_block+0xd2/0xa10 fs/nilfs2/mdt.c:254 nilfs_palloc_get_block.isra.0+0xc2/0x310 fs/nilfs2/alloc.c:239 nilfs_palloc_get_entry_block+0x90/0xb0 fs/nilfs2/alloc.c:355 nilfs_dat_translate+0x82/0x3b0 fs/nilfs2/dat.c:406 nilfs_bmap_lookup_at_level+0x250/0x460 fs/nilfs2/bmap.c:71 nilfs_bmap_lookup fs/nilfs2/bmap.h:182 [inline] nilfs_mdt_submit_block+0x1a1/0x890 fs/nilfs2/mdt.c:144 nilfs_mdt_read_block+0x93/0x3c0 fs/nilfs2/mdt.c:178 nilfs_mdt_get_block+0xd2/0xa10 fs/nilfs2/mdt.c:254 nilfs_sufile_read+0x20e/0x4f0 fs/nilfs2/sufile.c:1243 nilfs_load_super_root fs/nilfs2/the_nilfs.c:128 [inline] load_nilfs+0x6b5/0x13f0 fs/nilfs2/the_nilfs.c:308 nilfs_fill_super fs/nilfs2/super.c:1075 [inline] nilfs_get_tree+0xa71/0x1100 fs/nilfs2/super.c:1228 vfs_get_tree+0x90/0x340 fs/super.c:1814 do_new_mount fs/namespace.c:3560 [inline] path_mount+0x1290/0x1bc0 fs/namespace.c:3887 do_mount+0xb4/0x110 fs/namespace.c:3900 __do_sys_mount fs/namespace.c:4111 [inline] __se_sys_mount fs/namespace.c:4088 [inline] __x64_sys_mount+0x193/0x230 fs/namespace.c:4088 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f -> #0 (&nilfs_bmap_dat_lock_key){++++}-{4:4}: check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain kernel/locking/lockdep.c:3906 [inline] __lock_acquire+0x2846/0x46b0 kernel/locking/lockdep.c:5228 lock_acquire kernel/locking/lockdep.c:5851 [inline] lock_acquire+0x1b6/0x570 kernel/locking/lockdep.c:5816 down_read+0x9c/0x480 kernel/locking/rwsem.c:1524 nilfs_bmap_lookup_at_level+0x7f/0x460 fs/nilfs2/bmap.c:65 nilfs_bmap_lookup fs/nilfs2/bmap.h:182 [inline] nilfs_mdt_submit_block+0x1a1/0x890 fs/nilfs2/mdt.c:144 nilfs_mdt_read_block+0x93/0x3c0 fs/nilfs2/mdt.c:178 nilfs_mdt_get_block+0xd2/0xa10 fs/nilfs2/mdt.c:254 nilfs_palloc_get_block.isra.0+0xc2/0x310 fs/nilfs2/alloc.c:239 nilfs_palloc_get_desc_block+0x91/0xb0 fs/nilfs2/alloc.c:296 nilfs_palloc_prepare_alloc_entry+0x27e/0xbb0 fs/nilfs2/alloc.c:607 nilfs_dat_prepare_alloc+0x24/0x90 fs/nilfs2/dat.c:78 nilfs_dat_prepare_update+0x59/0x80 fs/nilfs2/dat.c:250 nilfs_direct_propagate fs/nilfs2/direct.c:279 [inline] nilfs_direct_propagate+0x1e4/0x330 fs/nilfs2/direct.c:261 nilfs_bmap_propagate+0x79/0x170 fs/nilfs2/bmap.c:329 nilfs_collect_file_data+0x49/0xe0 fs/nilfs2/segment.c:589 nilfs_segctor_apply_buffers+0x149/0x490 fs/nilfs2/segment.c:1010 nilfs_segctor_scan_file+0x3ed/0x570 fs/nilfs2/segment.c:1059 nilfs_segctor_collect_blocks+0x7cf/0x2b80 fs/nilfs2/segment.c:1221 nilfs_segctor_collect fs/nilfs2/segment.c:1547 [inline] nilfs_segctor_do_construct+0xf7b/0x5dc0 fs/nilfs2/segment.c:2122 nilfs_segctor_construct+0x5e1/0x840 fs/nilfs2/segment.c:2478 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2586 [inline] nilfs_segctor_thread+0x565/0xa50 fs/nilfs2/segment.c:2700 kthread+0x427/0x880 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 other info that might help us debug this: Chain exists of: &nilfs_bmap_dat_lock_key --> fs_reclaim --> &bmap->b_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&bmap->b_sem); lock(fs_reclaim); lock(&bmap->b_sem); rlock(&nilfs_bmap_dat_lock_key); *** DEADLOCK *** 2 locks held by segctord/13049: #0: ffff88801e9af2a0 (&nilfs->ns_segctor_sem){++++}-{4:4}, at: nilfs_transaction_lock+0x1eb/0x7c0 fs/nilfs2/segment.c:357 #1: ffff88805a142d60 (&bmap->b_sem){++++}-{4:4}, at: nilfs_bmap_propagate+0x25/0x170 fs/nilfs2/bmap.c:328 stack backtrace: CPU: 0 UID: 0 PID: 13049 Comm: segctord Not tainted 6.14.0-rc5-dirty #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <task> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120 print_circular_bug.isra.0+0x505/0x740 kernel/locking/lockdep.c:2076 check_noncircular+0x2f1/0x3d0 kernel/locking/lockdep.c:2208 check_prev_add kernel/locking/lockdep.c:3163 [inline] check_prevs_add kernel/locking/lockdep.c:3282 [inline] validate_chain kernel/locking/lockdep.c:3906 [inline] __lock_acquire+0x2846/0x46b0 kernel/locking/lockdep.c:5228 lock_acquire kernel/locking/lockdep.c:5851 [inline] lock_acquire+0x1b6/0x570 kernel/locking/lockdep.c:5816 down_read+0x9c/0x480 kernel/locking/rwsem.c:1524 nilfs_bmap_lookup_at_level+0x7f/0x460 fs/nilfs2/bmap.c:65 nilfs_bmap_lookup fs/nilfs2/bmap.h:182 [inline] nilfs_mdt_submit_block+0x1a1/0x890 fs/nilfs2/mdt.c:144 nilfs_mdt_read_block+0x93/0x3c0 fs/nilfs2/mdt.c:178 nilfs_mdt_get_block+0xd2/0xa10 fs/nilfs2/mdt.c:254 nilfs_palloc_get_block.isra.0+0xc2/0x310 fs/nilfs2/alloc.c:239 nilfs_palloc_get_desc_block+0x91/0xb0 fs/nilfs2/alloc.c:296 nilfs_palloc_prepare_alloc_entry+0x27e/0xbb0 fs/nilfs2/alloc.c:607 nilfs_dat_prepare_alloc+0x24/0x90 fs/nilfs2/dat.c:78 nilfs_dat_prepare_update+0x59/0x80 fs/nilfs2/dat.c:250 nilfs_direct_propagate fs/nilfs2/direct.c:279 [inline] nilfs_direct_propagate+0x1e4/0x330 fs/nilfs2/direct.c:261 nilfs_bmap_propagate+0x79/0x170 fs/nilfs2/bmap.c:329 nilfs_collect_file_data+0x49/0xe0 fs/nilfs2/segment.c:589 nilfs_segctor_apply_buffers+0x149/0x490 fs/nilfs2/segment.c:1010 nilfs_segctor_scan_file+0x3ed/0x570 fs/nilfs2/segment.c:1059 nilfs_segctor_collect_blocks+0x7cf/0x2b80 fs/nilfs2/segment.c:1221 nilfs_segctor_collect fs/nilfs2/segment.c:1547 [inline] nilfs_segctor_do_construct+0xf7b/0x5dc0 fs/nilfs2/segment.c:2122 nilfs_segctor_construct+0x5e1/0x840 fs/nilfs2/segment.c:2478 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2586 [inline] nilfs_segctor_thread+0x565/0xa50 fs/nilfs2/segment.c:2700 kthread+0x427/0x880 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </task> ================================================================== I hope it helps. Best regards Jianzhou Zhao</xrivendell7@xxxxxxxxx></xnxc22xnxc22@xxxxxx>
